ARK-OS/arkos/system/init.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <string.h>
#include "../vendor/verify/sha256.h"

#ifndef ARK_KEY
#define ARK_KEY "UNKNOWN_KEY"
#endif

void trigger_kernel_panic(const char *msg) {
    printf("\n======================================================\n");
    printf("                   KERNEL PANIC\n");
    printf("             Please reboot your computer.\n");
    printf("======================================================\n");
    printf("VFS: Unable to mount root fs on unknown-block(0,0)\n");
    printf("ArkOS Verified Boot: %s\n", msg);
    while (1) {
        sleep(1);
    }
}

int verify_os_signature() {
    // Read signature.bin
    int sig_fd = open("/signature.bin", O_RDONLY);
    if (sig_fd < 0) {
        trigger_kernel_panic("Missing signature.bin!");
        return 0;
    }
    char expected_sig[65] = {0};
    read(sig_fd, expected_sig, 64);
    close(sig_fd);

    // Read arkrt
    int os_fd = open("/arkrt", O_RDONLY);
    if (os_fd < 0) {
        trigger_kernel_panic("Missing /arkrt OS binary!");
        return 0;
    }

    struct stat st;
    fstat(os_fd, &st);
    uint8_t *os_data = malloc(st.st_size);
    if (!os_data) {
        trigger_kernel_panic("Out of memory during verification!");
        return 0;
    }
    
    // Read entire binary
    size_t total_read = 0;
    while (total_read < st.st_size) {
        ssize_t r = read(os_fd, os_data + total_read, st.st_size - total_read);
        if (r <= 0) break;
        total_read += r;
    }
    close(os_fd);

    // Compute SHA256(KEY + OS_DATA)
    SHA256_CTX ctx;
    sha256_init(&ctx);
    sha256_update(&ctx, (const uint8_t*)ARK_KEY, strlen(ARK_KEY));
    sha256_update(&ctx, os_data, st.st_size);
    
    uint8_t hash[32];
    sha256_final(&ctx, hash);
    free(os_data);

    // Convert hash to hex string
    char computed_sig[65] = {0};
    for (int i = 0; i < 32; i++) {
        sprintf(&computed_sig[i*2], "%02x", hash[i]);
    }

    if (strncmp(expected_sig, computed_sig, 64) != 0) {
        printf("Expected Signature: %s\n", expected_sig);
        printf("Computed Signature: %s\n", computed_sig);
        trigger_kernel_panic("Signature mismatch! System compromised or invalid key.");
        return 0;
    }
    
    return 1;
}

int main() {
    // Mount essential filesystems
    mkdir("/dev", 0755);
    mkdir("/proc", 0755);
    mkdir("/sys", 0755);
    
    mount("devtmpfs", "/dev", "devtmpfs", 0, NULL);
    mount("proc", "/proc", "proc", 0, NULL);
    mount("sysfs", "/sys", "sysfs", 0, NULL);
    
    // Set up standard file descriptors
    int fd = open("/dev/console", O_RDWR);
    if (fd >= 0) {
        dup2(fd, 0);
        dup2(fd, 1);
        dup2(fd, 2);
        if (fd > 2) close(fd);
    }
    
    // Force black background, clear screen, hide cursor (prevents white flash)
    printf("\033[0;40m\033[2J\033[H\033[?25l");
    fflush(stdout);
    
    // VERIFIED BOOT CHECK
    verify_os_signature();
    
    // Launch the swift application
    pid_t pid = fork();
    if (pid == 0) {
        char *argv[] = { "/arkrt", NULL };
        char *envp[] = { "PATH=/bin:/usr/bin:/sbin", NULL };
        execve("/arkrt", argv, envp);
        printf("Execve failed!\n");
        exit(1);
    }
    
    // PID 1 must never exit
    int status;
    waitpid(pid, &status, 0);
    
    printf("ArkOS Service Manager (arkrt) exited. Hanging system to prevent kernel panic...\n");
    while(1) sleep(1);
    return 0;
}